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a log engine that receives log files from the at least one internet server, processes 
hits logged in each log file, land stores traffic data derived from the hits in the visitor centric 
database, wherein the visitor /centric database associates the traffic data derived from the hits with 
a visitor that generated the mt; and 

a report engipe that generates reports using the traffic data stored in the visitor 
centric database.— 

-7. The systenj of claim 6, wherein the visitor centric database comprises a plurality 
of hash tables.— 

-8. The system of claim 6, wherein the plurality of hash tables comprise: 

a visitor table that stores traffic information derived from the hits, wherein the 

visitor table contains a unique visitor record for each visitor; and 

a plurality of data tables, wherein each data table stores data related to a respective 

non-unique parameter.— 



-9. The system of claim 8, wherein the visitor table comprises at least one pointer to 
at least one recora stored in at least one of the data tables.— 
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-10. The system of claim 8, wherein the respective non-unique parameters comprise: 
domain names from which the visitors originated; 
web browsers usda by the visitors; and 

other internet sites that referred the visitors to the at least one internet site.— 

—11. The system of claim 6, wherein the log engine comprises a database buffer that 
temporarily stores the traffic data derived from the hits logged in the log files.— 

-12. The system pf claim 11, wherein the log engine further comprises a database 
updater that transfers the ^raffic data temporarily stored in the database buffer to the visitor 
centric database.- 

—13. The system of claim 12, wherein the database updater sorts the traffic data 
temporarily stored in /he database buffer before transferring the traffic data to the visitor centric 
database.— 

—14. Thi system of claim 6, wherein the log engine comprises a log parser that reads 
log lines in the lag files, and separates each log file into individual fields. 



-15. fThe system of claim 14, wherein the log parser is adapted to process the log lines 
in real time a^ each hit is logged to a log file.— 
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--16. The system of claim/6, wherein the log engine is configured to process hits from 
multiple internet sites that are logged to a single log file.- 

—17. The system of cla/m 6, wherein the log engine comprises a website identifier that 
identifies a source of each hit.—/ 

--18. The system of /claim 8, wherein the log engine comprises a visitor identifier that 
determines if a hit originates/from a new visitor or an existing visitor.— 

--19. The system pf claim 18, wherein the visitor identifier is adapted to create a new 
visitor record if a hit originates from a new visitor.-- 

—20. The system of claim 6, wherein the log engine comprises a domain name system 
(DNS) resolver that determines host and domain information for each visitor.- 

—21. The system of claim 20, wherein the DNS resolver utilizes reverse DNS 
resolution to determine the host and domain information for each visitor.— 

—22. Toe system of claim 6, wherein the log engine is adapted to process e-commerce 
log files that coptain information on money spent by a visitor.- 
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-23. The system of claim 22, wherein the report engine is adapted to generate reports 
that correlate money spent by a visitor /to any other parameter of the traffic data.— 

—24. The system of claip 22, wherein the report engine is adapted to generate a top 
products report that ranks products purchased by visitors based on revenues generated by the 
products.— 

-25. The system of claim 22, wherein the report engine is adapted to generate at least 
one of a totals report, product tree report, regions report, and top scores report.— 

-26. The sysjfem of claim 6, wherein the report engine is adapted to generate a report 
that displays a value pf at least one traffic data parameter over at least one predetermined time 
period.— 

—27. Tne system of claim 26, wherein the report comprises a snapshot report in which 
the at least one predetermined time period comprises seven consecutive 24 hour time periods. - 



-28/ The system of claim 26, wherein the report comprises an hourly graph report in 
which th& at least one predetermined time period comprises a plurality of consecutive one hour 
time pe^ods.- 
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—29. The system hi claim 6, wherein the report engine is adapted to generate a top 
pages report that ranks website pages based on number of visitors to the website pages.— 

-30. The system of claim 29, wherein each entry in the top pages report comprises a 
link for accessing additional information about a respective website page.— 




—31. The system of claim 6, wherein the report engine is adapted to generate a search 
engine report that displays a list of most used search engines.— 



—32. Trie system of claim 6, wherein the report engine is adapted to generate a top 
domains report mat displays regional and network information about the visitors.— 

—33. / The system of claim 6, wherein the report engine is adapted to generate a browser 
tree report ithat ranks internet browsers based on which internet browsers are used most by 
visitors to a website.— 

7-34. The system of claim 33, wherein each internet browser entry in the browser tree 
report includes a link for accessing information about different versions of a respective internet 
browser. ~ 
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--35. The system of c/aim 6, wherein the report engine is adapted to generate a top 
entrances report that ranks starting points of visitors to a website based most used starting 
points.- / 



—36. The system of claim 6, wherein the report engine is adapted to generate at least 
one of a summary report! a daily graph report, a monthly graph report, a top servers report, a file 
types report, a status/errors report, a posted forms report, a top referrals report, a top keywords 
report, a referral tree report, a domain tree report, a top countries report, a platform tree report, a 
top combos report, a top exits report, a click through report, a depth of visit report, a length of 
visit report, and a usernames report.— 

-37. The system of claim 6, wherein the report engine comprises: 
a template module that stores report templates; 

a session parser that receives report requests from the at least one server, and 
determines a type/of report requested, data needed to generate a requested report and a format for 
the requested report; 

in authenticator that receives an identity of a report requester from the session 
parser, and verifies that the report requester has permission to view a requested report; 
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a data query module tttat receives authentication information from the 
authenticated and that queries the database for data needed to generate the requested report if the 
report requester has permission to view the requested report; and 

a format output module that receives the data needed to generate the requested 
report from the database, retrieves templates for the requested report from the template module, 
creates the requested report, and delivers the requested report to the report requester.— 

—38. The system of claim /37, wherein the template module also stores at least one 
dictionary.— 

—39. The system of claini 38, wherein the format output module is adapted to create the 
requested report in a selectable language using the at least one dictionary.— 

—40. A system for analyzing and monitoring internet traffic generated by visitors to at 
least one internet site hosted tw at least one internet server, comprising: 

means for receiving log files from the at least one internet server; 

means for processing hits logged in each log file; 

means for s/oring traffic data derived from the hits in a database; 

means foy associating the traffic data derived from the hits and stored in the 
database with a visitor mat generated the hit; and 
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means for generating repots using the associated traffic data stored in the 



database.- 



-41. The system of claim/ 40, wherein the database comprises a plurality of hash 



tables.— 



-42. The system of clawn 41 , wherein the plurality of hash tables comprise: 

a visitor table tHat stores traffic information derived from the hits, wherein the 

visitor table contains a unique visitor record for each visitor; and 

a plurality of qata tables, wherein each data table stores data related to a respective 

non-unique parameter. 

—43. The systerii of claim 42, wherein the visitor table comprises at least one pointer to 
at least one record stored in at least one of the data tables.— 

—44. The system of claim 40, further comprising buffer means for temporarily storing 
the traffic data derived from the hits logged in the log files. - 



-45. TBe system of claim 44, wherein the storing means comprises database update 
means for transferring the traffic data temporarily stored in the buffer means to the database.— 
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—46. The system of claim 45, wherein the database update means sorts the traffic data 
temporarily stored in the buffer means before transferring the traffic data to the database.— 

—47. The system of claim 4y, wherein the processing means comprises log parser 
means for reading log lines in the log files, and for separating each log line into individual 
fields.-- / 

—48. The system of claim 47, wherein the log parser means processes the log lines in 
real time as each hit is logged to a log file.— 

—49. The system off claim 40, wherein the processing means processes hits originating 
from multiple internet site/ and logged to a single log file.— 

-50, The sy/tem of claim 40, wherein the processing means comprises website 
identification means mat identifies a source of each hit.— 

—51. The system of claim 42, wherein the processing means comprises visitor 
identification mians that determines if a hit originates from a visitor with a preexisting visitor 
record in the database. - 
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—52. The system of claim 51, wherein the visitor identification means creates a new 
visitor record if a hit originates froip a visitor without a preexisting visitor record in the 
database.-- 

—53. The system of claim AO, wherein the processing means comprises domain name 
system (DNS) resolver means that aetermines host and domain information for each visitor.— 

-54. The system of clim 53, wherein the DNS resolver means utilizes reverse DNS 
resolution to determine the host find domain information for each visitor.— 
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-55. A system for analyzing and monitoring internet traffic generated by visitors to at 
least one internet site hosted/by at least one internet server, comprising: 
a database; j 

a log engpe that receives log files from the at least one internet server, processes 
hits logged in each ldg file, and stores traffic data extracted from the processed hits in the 
database, wherein thgrlog engine comprises, 

a database buffer that temporarily stores traffic data received from the 

database, 

a log parser that processes each hit in each log file, and separates each hit 
into its individ/ial fields, 
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a visitor identifier that receives each hit's individual fields from the log 
parser, identifies each hit as originating from either a new visitor or an existing visitor, and 
creates a new visitor record in the database* buffer if a hit originates from a new visitor, 

a buffer updater that, prior to processing a new log file, copies previously 
stored data from the database to the database buffer, and wherein, for each hit, the buffer updater 
locates in the database buffer the visiton record identified or created by the visitor identifier for a 
respective hit, and updates the identified or created visitor record in the database buffer with 
traffic data derived from the respective/ hit, and 

a database updater that copies updated traffic data from the database buffer 
to the database after all hits in the new log file have been processed; and 

a report engiije that generates reports using the traffic data stored in the 

database.— 

—56. The system of claiin 55, wherein the log parser is updated to process each hit in 
real time as each hit is added to a log file. — 

— 57. The system of /claim 55, wherein the log engine further comprises a website 
identifier that identifies a source of each hit.— 



—58. The system bf claim 57, wherein the website identifier identifies the source of 
each hit from website identifier text received from the log parser for each hit. — 
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-59. The system of claim 55, wherein the log engine further comprises a domain name 
system (DNS) resolver that determines host and domain information for each visitor to an 
internet site.-- / 

—60. The system of claim 59, wherein the DNS resolver is adapted to process multiple 
DNS queries in parallel.-- / 

-61. The system of clawn 55, wherein the log engine is adapted to process e-commerce 
log files that contain information on money spent by the visitor.— 

-62. A method of analyzing and monitoring internet traffic generated by visitors to at 
least one internet site hosted/by at least one internet server, comprising the steps of: 

receiving log files from the at least one internet server; 

processing jnits logged in each log file; 

storing, irya database, traffic data derived from the hits; and 

associating the traffic data derived from the hits and stored in the database with a 
visitor that generated tpe hit— 



-63. The 



the associated traffic 



lethod of claim 62, further comprising the step of generating reports using 
data stored in the database.— 
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-64. The method of claim 63, wherein the traffic data derived from the hits is stored in 
a plurality of hash tables.-- / 



-65. The method of claim 64, wherein traffic information derived from the hits are 
stored in a visitor hash table that contains a unique visitor record for each visitor, and wherein 
data related to at least one non-unique parameter is stored in respective data tables.— 

-66. The method of claim 65, wherein the visitor hash table comprises at least one 
pointer that points to at least one record stored in at least one of the data tables.— 

-67. The method of claim 62, further comprising the step of temporarily storing the 
traffic data derived from the nits in a buffer prior to storing the traffic data in the database.— 

-68. The method of claim 67, further comprising the step of sorting the traffic data 
stored in the buffer prior to storing the traffic data in the database.— 

—69. The method of claim 62, wherein the step of processing hits logged in each log 
file comprises the steps off: 

reading log lines in the log files; and 
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separating each log line into individual fields. - 

—70. The method of claim 69, wherein the hits logged in each log file are processed in 
real time as each hit is logged top log file.— 

—71. The method of claim 62, wherein the processing step comprises processing hits 
originating from multiple sources that are logged to a single log file.— 

—72. The method oqclaim 62, further comprising the step of identifying a source from 
which each hit originates.— 

—73. The method/of claim 65, further comprising the steps of: 

determining if a hit originates from a visitor with a preexisting visitor record in 
the database; andi 

creating k new visitor record if the hit originates from a visitor without a 
preexisting visitor record in the database.— 



—74. The method of claim 62, further comprising the step of determining host and 
domain information for each visitor.— 
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—75. The method of clairfi 74, wherein host and domain information for each visitor is 
determined using reverse domain name system (DNS) resolution.— 

—76. A method of processing a log file to obtain traffic data, comprising the steps of: 
copying previously stored traffic data from a database to a database buffer; 
separating hits flogged in the log file into individual fields; 
identifying each hit as originating from either a new visitor or an existing visitor; 
creating a ne^ visitor record in the database buffer if a hit originates from a new 

visitor; 

for each hit/ locating the visitor record identified or created and updating the 
identified or created visitqr record in the database buffer with traffic data derived from the 
respective hit; and 

copying Updated traffic data from the database buffer to the database after all hits 
in the log file have been processed.— 

-77. The mjethod of claim 76, further comprising the step of generating a report based 
on the traffic data in/the database.— 

-78. Ths method of claim 76, wherein the hits logged to the log file are processed in 
real time as each nit is logged to the log file.— 
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—79. The method of cpim 76, wherein hits originating from multiple sources are 
logged to the log file.- 

-80. The method />f claim 79, further comprising the step of identifying a source from 
which each hit originates. 




—81. The method of claim 76, further comprising the step of determining host and 
omain information for each visitor.— 



-82. The method of claim 81, wherein host and domain information for each visitor is 
determined using reverse domain name system (DNS) resolution.— 
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